tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Use bound parameters for every query that takes user data.

Browse Source 
The queue image query took $id without quotes or a check, which allowed
SQL injection.
This commit is contained in:
tim
2026-09-25 21:29:09 +02:00
parent cda0602c95
commit c85f54116c
7 changed files with 70 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files
publish/addeditor.php
+5 -8
View File
@@ -12,14 +12,11 @@ if (!isset($_SESSION['editor'])) {
open_db('open');
$table = "editors";
$username = $db->real_escape_string($_POST['username'] ?? '');
$password = $db->real_escape_string(password_hash($_POST['password'] ?? '', PASSWORD_DEFAULT));
$email = $db->real_escape_string($_POST['email'] ?? '');
$query = "INSERT INTO $table SET".
"`username` = '".$username."', ".
"`password` = '".$password."', ".
"`email` = '".$email."'; ";
if ($result = $db->query($query)) {
$username = (string)($_POST['username'] ?? '');
$password = password_hash((string)($_POST['password'] ?? ''), PASSWORD_DEFAULT);
$email = (string)($_POST['email'] ?? '');
$query = "INSERT INTO $table SET `username` = ?, `password` = ?, `email` = ?";
if ($result = $db->execute_query($query, array($username, $password, $email))) {
$added = TRUE;
$is_admin = TRUE;
}